Privacy Policy

This document is the text published at peonix.app/privacy — it is rendered from this file, so what an attorney reviews is exactly what the site serves. It was prepared by the operator with AI assistance and is not legal advice; it is scheduled for review by licensed counsel before scale. Questions: support@peonix.app

Last updated: October 5, 2026

Who we are. Peonix (the "Platform") is operated by Greenwind LLC, a Florida limited liability company with its registered office in St. Petersburg, Pinellas County, Florida ("we," "us," "our"). This Privacy Policy explains what personal information we collect and how we use it.

Two kinds of users. We serve (1) merchants — flower shops that use the Platform to run their business — and (2) storefront customers — people who place orders through a merchant's public online store. For storefront customer information, the merchant is responsible for how that information is used; we process it on the merchant's behalf. If you are a storefront customer with questions about your data, please contact the shop you ordered from; you may also contact us at the address below. A shop can publish its own refund, shipping, terms and privacy documents on its storefront, starting from a sample the Platform provides (in English only); those are the shop's own documents, not ours.

Contact: support@peonix.app · Greenwind LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA. The same postal address is in the footer of every email we send.

Information we collect

From merchants (when you sign up and use the Platform):

• Account details: name, email address, phone number, password (stored hashed), and staff you invite. We may call the phone number to confirm that a new sign-up is a working flower business.
• Business information: shop name and address (street, city, state and ZIP — which set the shop's sales-tax location and time zone), what the shop sells (asked at sign-up), contact details, delivery zones, tax settings, and storefront configuration.
• Where you came from: if you arrive at sign-up from a link carrying campaign tags (such as utm_source) or an advertising click identifier, and the page that referred you, we record them with your sign-up so we can tell which of our advertising works. Until you sign up they are kept only in that browser tab (session storage, not a cookie), and only the referring site's name is kept — never the full address you came from. We do not run advertising pixels, and we do not share this with advertising networks.
• An unfinished sign-up: the email address you enter on the first step is kept, with how far the form got, even if you never finish. We use it only to see where the sign-up form loses people — never for marketing — and delete it after 90 days.
• Usage and device data: log records, session cookies, and basic technical information.
• Billing information is collected and processed by our payment processor (Stripe); we do not store full card numbers.

From storefront customers (when you order through a shop's online store):

• Contact and delivery details: name, phone number, delivery address, and (optionally) email.
• Order details: items ordered, recipient information, gift messages, delivery date and instructions.
• Delivery: a shop can give a courier a link, without a password, that shows that one order's delivery details (recipient name, address, phone and delivery instructions). The courier can close the order from that link with a proof-of-delivery photo, which is stored with the order and deleted automatically about 183 days (six months) after the order event it belongs to; the order record itself stays.

Automatically:

• A strictly necessary session cookie to keep you signed in and to protect against cross-site request forgery. On a shop's online store, a strictly necessary cookie keeps the buyer's checkout together between pages. We do not use third-party advertising cookies.
• On your own device: the Platform can keep an unsent form (for example, an order being written) in your browser's local storage so nothing is lost if the page closes. It stays on that device and is cleared when the form is saved or discarded. In the same way a storefront visitor's cart, and the light or dark display choice on our public pages, are kept in the browser on that device only.

How we use information

• To provide and operate the Platform and the merchant's store.
• To process and fulfill orders and send transactional notifications (for example, order updates) on the merchant's behalf.
• To secure the Platform, prevent abuse, troubleshoot, and keep audit records.
• To communicate with merchants about their account and the service.
• To comply with legal obligations.

We do not sell personal information, and we do not use storefront customers' data for our own marketing.

How we share information

We share information only with service providers that help us run the Platform, each limited to what it needs:

• Hosting — Vultr (Constant Company, LLC). The application, its database and the photos merchants upload all live on a server in Miami, Florida, United States, and so do the backups.
• Email provider (Resend) to deliver transactional email.
• Telegram, only where a merchant enables Telegram notifications.
• Bot check on the sign-up page (Cloudflare Turnstile), on the registration form only and only while we have it switched on. It receives the visitor's IP address and the browser signals it needs to tell a person from an automated script — and nothing typed into the form.
• Website analytics (Umami) on our public marketing pages and the sign-up page only: aggregate page counts, no cookies, no cross-site tracking, no advertising identifiers. The Platform itself carries no analytics.
• Payment processor (Stripe) for subscription billing — we never see full card numbers. Stripe also processes the card payments and invoices of a shop that takes cards on its storefront: those run on the shop's own Stripe account, the buyer enters card details on Stripe's page and never on ours, and Stripe receives the order amount, the shop's name and the buyer's email address and name where the shop has them. When a shop connects its Stripe account, its business details go to Stripe under Stripe's own terms.
• Browser push services (Apple, Google, Mozilla or Microsoft — whichever one the browser uses), only where a shop administrator has turned on push notifications on a phone or computer. What leaves is the notification itself: a short title, the order number and the order total — no name, address, phone number or items.
• Address lookup (Geoapify, on OpenStreetMap data), used only in a merchant's own order form when their staff type a delivery address. What leaves is the partial address as it is being typed, plus a map point in the middle of the shop's state that only nudges the order of the results, and nothing else — no name, no phone number, no email address, no order, no payment detail, and nothing identifying whose address it is or which shop is asking. We record how many lookups a shop made, never what they were. It does not run on the public store: an address a buyer types there is matched against a dataset that ships inside the Platform and reaches no outside service. Full detail, and the attribution its licence requires, at Data Sources.
• AI provider (Anthropic, model Claude Haiku 4.5), only where a merchant's administrator has switched on the assistant's answers in words — and only for shops on a plan that includes it. Nothing is sent unless that switch is on: without it the assistant answers from our own server and reaches no third party at all. When it is on, what leaves is the question the person typed and the rows of the answer our server has already computed — figures, flower and bouquet names, and the prices and stock levels of the shop's materials. Customer names are replaced with «Customer #3» except in a question about one named customer, where the name is the question. Order notes, gift-card messages, addresses, phone numbers, email addresses, payment details and passwords are never sent. Anthropic does not train its models on this data and retains it for 7 days. The merchant's consent is recorded with the name of the person who gave it, the date, and the revision of the disclosure they read; a materially changed disclosure pauses the feature until it is agreed again.

We may also disclose information if required by law or to protect our rights, and in connection with a business transfer (e.g., merger or sale), subject to this Policy.

Where your data is stored

In the United States. The Platform runs on a single server in Miami, Florida, and its backups are held in the same facility. We do not currently copy data to any other country or to any other storage provider; if that changes, this Policy and the list above change with it before the data moves.

Data storage, security & retention

Data is stored in a PostgreSQL database with per-shop isolation so shops cannot access one another's data. We use signed session cookies, restrict access to production data, keep platform secrets out of the database, and apply security controls appropriate to the service. No method of storage or transmission is 100% secure.

Account activity log. The Platform records who changed what inside a shop's account — orders, payments, stock, and the shop's settings (its address, tax settings, storefront, team, payment policy and consents) — with the previous and the new value. A shop's administrators and owners see this log in the application (Журнал). Peonix staff can see the same records for a shop through the platform console, and use them only to provide support, to keep the service secure, and to resolve a dispute about what was changed and when. Ordinary entries are kept for 365 days; entries about the shop's address and tax settings — the records a sales-tax audit may ask for — are kept for 7 years; each confirmation of tax settings a shop makes is kept for as long as the account exists. These periods apply while the account exists: when a shop closes its account, everything — these records included — is deleted when the 30-day window ends, so a shop should export its tax history first. Keeping tax records is the shop's own legal duty.

We keep information for as long as an account is active and as needed to provide the service, then delete or anonymize it within a reasonable period (target 30 days after account closure). One shorter window is worth naming on its own: where a shop has switched on the assistant's answers in words, we keep the text of each question for 90 days — so we can see what the assistant is failing to understand — after which the text is deleted and only the numbers (which function ran, how long it took, what it cost) remain. Backups cycle out on a rolling basis: we keep 7 daily and 4 weekly copies, so a restore can reach back about 28 days. A deletion therefore also clears from backups within that window.

Your choices and rights

• Merchants can access and update account information in Settings, request an export of their shop's data, and request deletion of their account.
• Storefront customers should direct requests about their order data to the shop they ordered from (the controller). You may also contact us and we will route your request to the relevant shop.
• Depending on where you live, you may have rights to access, correct, or delete your personal information. To make a request, email support@peonix.app; we respond within 30 days.
• California residents. We do not sell or share personal information as the CCPA/CPRA define those terms, and we do not use it for cross-context behavioural advertising. We honour access, correction, deletion and portability requests, and we will not discriminate against you for making one.
• Outside the United States. Peonix is offered to businesses in the United States only and is not offered or marketed in the European Economic Area, the United Kingdom or Switzerland.

Children

The Platform is for businesses, and the person who registers a shop must be at least 18. It is not directed to children under 13, and we do not knowingly collect their information.

Changes

We may update this Policy; we will post the new version with a revised effective date and, for a material change, email subscribed shops at least 30 days before it takes effect.

Governing law

This Policy is governed by the laws of the State of Florida, USA, without regard to conflict-of-laws rules.

Open items for counsel review: a formal data-processing addendum (DPA) for merchants who ask for one; confirmation of the retention windows against the backup schedule.